The legal aspect might change what AT&T 'has' to log, although they likely voluntarily include other passively-obtained port 53 traffic in their cooperation.